Pulling code onto a server with Git is simple until it is not. These are the Git errors that most often stop a deployment, with safe fixes that keep server-only files intact.
Before you start
- SSH access to the server and the user that owns the repository.
- A backup or at least
git statusoutput before running anything destructive.
fatal: detected dubious ownership in repository
fatal: detected dubious ownership in repository at '/var/www/app'Git refuses to work in a repository owned by another user (a security fix since Git 2.35.2). Run Git as the owner (sudo -u deploy git pull), fix ownership (chown -R deploy:deploy /var/www/app), or, if the mixed ownership is intended, trust the path:
git config --global --add safe.directory /var/www/appYour local changes would be overwritten by merge
Someone edited files directly on the server. See what changed first:
git status && git diff- Changes worth keeping: copy them into the repository properly and commit them there.
- Changes to discard:
git checkout -- path/to/file(orgit restore). - To keep them aside temporarily:
git stash, pull, then decide.
Server-specific files (.env, uploads, caches) should be in .gitignore so this does not happen.
fatal: Need to specify how to reconcile divergent branches
The server's branch has commits that are not on the remote (or history was rewritten). Deployment checkouts should never have their own commits. If the remote is the source of truth:
git fetch origin && git reset --hard origin/mainThis discards local commits and tracked changes on the server; untracked files like .env stay. Set the default to fast-forward only so this is caught early: git config pull.ff only.
Permission denied (publickey)
git@github.com: Permission denied (publickey).- Test the key:
ssh -T git@github.com. - Make sure the server's public key is added as a deploy key on the repository (or to an account with access).
- If the key file is not the default name, point SSH to it in
~/.ssh/configwithIdentityFileandIdentitiesOnly yes. - Run Git as the user who owns that key, not root.
remote: Support for password authentication was removed
GitHub and most hosts no longer accept account passwords over HTTPS. Switch the remote to SSH with a deploy key:
git remote set-url origin git@github.com:you/app.gitor use a fine-grained personal access token instead of the password.
Host key verification failed
The server has never connected to the Git host. Add its key once: ssh-keyscan github.com >> ~/.ssh/known_hosts, ideally comparing fingerprints with the host's published ones.
Other common messages
| Message | Fix |
|---|---|
error: cannot open .git/FETCH_HEAD: Permission denied | Wrong owner of .git; fix ownership |
fatal: not a git repository | Wrong directory, or the site was uploaded without .git |
error: RPC failed; curl 92 HTTP/2 stream was not closed cleanly | Large repo over unstable connection; retry or use SSH |
Your branch is behind 'origin/main' after fetch | Run git pull --ff-only to update |
Git deployment FAQ
Should the web server serve the .git folder?
Never. Block it in Nginx or Apache, or keep the repository outside the web root.
Is git reset --hard safe on a server?
It only discards tracked changes and local commits; untracked files such as .env and uploads remain. Check git status first.
Does cPanel support Git deployments?
Yes, through Git Version Control and a .cpanel.yml deployment file.